# Malicious pausing the contract

Auction._createAuction catches token.mint() failure and pauses; attacker tuning gas so mint OOGs but catch still has gas can pause the auction contract.

- Payout: Contest reward
- Severity: medium
- Program: Nouns Builder
- Credited: V\_B
- Disclosed: 2022-11-03
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-09-nouns-builder-findings/issues/719
- Library page: https://bugbountylibrary.com/r/c4%3A2022-09-nouns-builder%3AM-15
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:dos

**Target:** Auction.sol _createAuction / settleCurrentAndCreateNewAuction
**Root cause:** The catch block on token.mint() calls _pause() on any failure including out-of-gas, and EIP-150's 63/64 rule lets a caller supply just enough gas that mint OOGs while the remaining 1/64 suffices for _pause.
**Steps:**
1. Call `settleCurrentAndCreateNewAuction()` with a gas amount tuned so `token.mint()` (heavy: up to 100-iteration founder traversal, >1.5M gas) runs out of gas.
2. EIP-150 forwards at most 63/64 of remaining gas to the external call; the retained 1/64 (>20k gas) remains.
3. The `catch Error(string memory)` branch executes `_pause()`, halting auctions.
**How found:** Code review of _createAuction's try/catch: noticed catch pauses on any mint failure, then reasoned about EIP-150 63/64 gas forwarding to show an OOG in mint can still leave enough gas for _pause.
**Exploitation:** Any user calls settleCurrentAndCreateNewAuction with a crafted gas limit; the mint reverts OOG, the catch branch pauses the contract, denying auction settlement/minting.
**Insight:** try/catch around external calls treats out-of-gas as a catchable failure; combined with EIP-150's 63/64 rule, a caller can deliberately starve the inner call while leaving gas for the catch branch — check for state-changing catch handlers on gas-heavy external calls.